# Proxy Node Registry
## Naming Convention: srv244939.hostlocal.net (primary) / ridgeline (backup/temp-filter)

---

> **RESOLVED (2026-07-02):** Node 869377 (ridgeline) has been permanently reassigned as the **Vault node** — not a proxy. It no longer serves any proxy role. The primary proxy is srv244939.hostlocal.net (244939). Filter (333941) is active on 91.229.239.29 (Moldova). The backup proxy slot is currently vacant.


## Identity Convention

Proxy nodes are **configuration-identical** — same nginx templates, same WG config,
same vault tools, same Podman containers. Only IP, WG port, SSH port, and WG keypair differ.
This is intentional: different ports throw off fingerprinting.

| Int# | Name | Y:\ | WG IP | SSH Port | WG Port | Status | Public IP | Location |
|------|------|-----|-------|----------|---------|--------|-----------|----------|
| 244939 | srv244939.hostlocal.net | Y:\2\ | 10.69.69.3 | 9922 | 44634 | **PRIMARY** | 107.189.23.194 | Amsterdam |
| 869377 | ridgeline | — | 10.69.69.8 | 9922 | — | **REASSIGNED → VAULT** | 104.194.144.66 | London |
| — | proxy2 | TBD | TBD | TBD | TBD | VACANT | TBD | TBD |

> **OPSEC:** WG ports are random (40000–62000 range). SSH ports differ intentionally.
> Both nodes present identical nginx responses — no fingerprinting difference.

---

## Watchdog Failover

```
srv244939.hostlocal.net (primary) → ridgeline (failover) → proxy3 (last resort)
```

Shield watchdog monitors srv244939.hostlocal.net heartbeat every 15s:
- 3 failures → DNS TTL reduced to 60s
- 7 failures → DNS A record switches srv244939.hostlocal.net → ridgeline
- srv244939.hostlocal.net recovers → DNS A record restored, TTL → 300s

---

## Shared Proxy Config (both nodes identical)

```
Internet → srv244939.hostlocal.net OR ridgeline (nginx 80/443)
    ↓ wg7 (10.69.69.0/24)
    ↓ Shield hub (10.69.69.1)
    ↓ dispatch → Origin (89.127.235.207)
```

**Services on each proxy:**
- `nginx` — reverse proxy, SSL termination → Origin (89.127.235.207)
- `wg-quick@wg7` — Shield mesh (OPSEC port differs per node)
- `firewalld` — HTTP/HTTPS + SSH + WG port only
- `podman` — maintenance page container (activated by dispatch)

**No PHP, no DB, no secrets on proxy nodes.**

---

## DNS Records (cleanearth.cc)

```bash
# Check current A record
tvault exec pdns-manager -- get-a cleanearth.cc @

# Failover to ridgeline
tvault exec pdns-manager -- failover cleanearth.cc 104.194.144.66 60

# Restore to srv244939.hostlocal.net
tvault exec pdns-manager -- restore cleanearth.cc 107.189.23.194 300
```

---

## Vault Keys (Shield-derived)

| Node | Int# | node_key derivation | Cert |
|------|------|--------------------|----- |
| srv244939.hostlocal.net | 244939 | HMAC(MRK, "node_key:244939:proxy1") | nodes/244939.crt |
| ridgeline | 869377 | HMAC(MRK, "node_key:869377:proxy2") | nodes/869377.crt |


---

## Identity Convention

Each proxy node follows the same Ghost Architecture template.
All proxies are **interchangeable** — same nginx config, same WG config, 
same firewall rules. Only the IP, WG port, and WG keypair differ.

| Proxy ID | Y:\ Folder | WG ID | wg7 IP       | Status       | Public IP         | WG Port |
|----------|-----------|-------|--------------|--------------|-------------------|---------|
| PROXY 1  | Y:\2\     | proxy1 | 10.69.69.3  | ACTIVE       | 107.189.23.194    | 41820   |
| PROXY 2  | Y:\7\     | proxy2 | 10.69.69.4  | PROVISIONING | TBD               | 41652   |
| PROXY 3  | Y:\8\     | proxy3 | 10.69.69.7  | RESERVED     | TBD               | TBD     |
| PROXY 4  | Y:\9\     | proxy4 | 10.69.69.8  | RESERVED     | TBD               | TBD     |
| PROXY 5  | Y:\10\    | proxy5 | 10.69.69.9  | RESERVED     | TBD               | TBD     |

> **OPSEC:** WG ports are always random (40000–62000 range, not near 518xx).
> Ports are generated at provisioning time and documented here + Engine DB.

---

## Watchdog Failover Order

```
PROXY 1 (primary) → PROXY 2 (failover) → PROXY 3 (last resort)
```

Watchdog on Shield monitors heartbeat every 15s:
- 3 failures → TTL reduced to 60s on cleanearth.cc
- 7 failures → DNS A record → PROXY 2 IP
- PROXY 1 recovery → DNS A record restored, TTL → 300s

---

## Node Architecture (all proxies identical)

```
Internet → PROXY X (nginx 80/443) → Origin (89.127.235.207:443)
                    ↓
              wg7 (10.69.69.0/24) ← Shield hub
```

**Services on each Proxy:**
- `nginx` — reverse proxy, SSL termination → Origin
- `wg-quick@wg7` — mesh backbone (random OPSEC port)
- `firewalld/ufw` — HTTP/HTTPS + SSH only + WG port

**No PHP, no DB, no secrets on proxy nodes.**

---

## DNS Record (cleanearth.cc)

Managed via: `tvault exec pdns-manager -- <action>`

```bash
# Check current A record
tvault exec pdns-manager -- get-a cleanearth.cc @

# Failover to PROXY 2
tvault exec pdns-manager -- failover cleanearth.cc <PROXY2_IP> 60

# Restore to PROXY 1
tvault exec pdns-manager -- restore cleanearth.cc 107.189.23.194 300
```

---

## Provision a New Proxy

```bash
# On Engine via tvault:
tvault exec proxy-provision -- <NEW_IP> <proxy-id> <wg-port>

# Example: Proxy 2
tvault exec proxy-provision -- 1.2.3.4 proxy2 41652
```

Then copy SSL cert:
```bash
scp -P 9922 root@107.189.23.194:/etc/nginx/ssl/* root@<NEW_IP>:/etc/nginx/ssl/
ssh -p 9922 root@<NEW_IP> 'mkdir -p /etc/nginx/ssl && systemctl start nginx'
```
